strcat

80 ms·

781.
by strcat 11y ago
The grsecurity brand is a registered trademark and spender has the right to control how it's used. If you ship a product with the official grsecurity patch applied, you get to say it uses a grsecurity kernel in your marketing. If you w
782.
by strcat 11y ago
The grsecurity brand is a registered trademark and spender has the right to control how it's used. If you ship a product with the official grsecurity patch applied, you get to say it uses a grsecurity kernel in your marketing. If you w
783.
by strcat 11y ago
I don't think it would be particularly useful. The most common usage of seccomp is hardening an existing sandbox by reducing kernel attack surface. Fine-grained control is crucial for that, since it's the entire point. Every unnec
784.
by strcat 11y ago
You can almost do it, but you can't whitelist paths. Luckily, none of the hard-wired paths is particularly compelling. With either feature, you end up needing a multi-process architecture as soon as you want to allow access to certain
785.
by strcat 11y ago
The tame call isn't far from being an extremely coarse version of seccomp. In general, both require splitting up programs into components to implement a sandbox. Otherwise, they're only able to reduce the kernel attack surface for
786.
by strcat 11y ago
It's an extension running in the usual extension sandbox with permission to access the microphone. It's the "Ok, Google" implementation. It's a proprietary blob so you'd need to reverse engineer it to figure ou
787.
by strcat 11y ago
Firefox has similar code to download the proprietary EME plugin but it prompts the user about it first, which Chromium could be doing here.
788.
by strcat 11y ago
It's more secure than JavaScript, which is a start. Dropping the need for just-in-time compilation while gaining performance is nice.
789.
by strcat 11y ago
The sandbox binary uses setuid root if user namespaces aren't available, but that's a necessity for making the empty chroot and process/network namespaces used to sandbox tabs. The layer-2 sandboxing code (seccomp-bpf) doesn&
790.
by strcat 11y ago
Unlike Android, Chromium is mostly developed in the open. As someone who has contributed to both projects, I wouldn't say Chromium is any less welcoming to contributors than Firefox. Mozilla is a lot better at presenting themselves in
791.
by strcat 11y ago
PPAPI is just providing an alternate, lower-level interface to the same web techniques accessible via JavaScript APIs. There's a bit more power (OpenGL ES 2.0, not the crippled WebGL standard based upon it) but nothing very significant
792.
by strcat 11y ago
NaCl doesn't imply proprietary any more than a JavaScript engine does. The downloaded code is bytecode at an abstraction level a bit below C but quite a bit above assembly. It's not substantially different from a freedom perspecti
793.
by strcat 11y ago
No, it's just how it works. You can use `lddtree` if you want the linking dependency tree without that.
794.
by strcat 12y ago
Stop lying to push your biases please. People are smart enough to see through it. Chromium is an open-source project and no one has ever identified any spying code. If you think Google is capable of sneaking it in, then you should be worrie
795.
by strcat 12y ago
It's still a serious issue even with a sandbox, both because of the endless stream of kernel vulnerabilities and similar issues in userspace processes the sandboxed processes communicate with to get work done. Chromium's use of se
796.
by strcat 12y ago
No one is claiming that Google invented sandboxing. You should stop lying to push your bias because it only makes you look foolish.
797.
by strcat 12y ago
Google created seccomp-bpf which is crucial to a meaningful sandbox and has no equivalent on other platforms. It was not an obvious innovation or it would have been done years earlier. It exists because someone paid by Google to improve Chr
798.
by strcat 12y ago
There is no Windows sandbox (including the Chromium one) that's comparable to the quality of Chromium's Linux implementation. Note that seccomp is a layer on top of the layer-1 sandbox implementation based on a chroot and namesp
799.
by strcat 12y ago
> Of course, seccomp-nonbpf, selinux and quite a few other mechanisms have been around for a longer while. In non-Linux kernels in fact, there are FAR more secure mechanisms (but also, they don't run Linux binaries..) You're qu
800.
by strcat 12y ago
> - No stack overflow check in release mode. -fstack-check in GCC guarantees that the guard page will be hit (as long as there is one), assuming no undefined behaviour like buffer overflows. It has a negligible cost and should really be
801.
by strcat 12y ago
> There are certain scenarios that SSP is not used, such as with arrays that are less than 8 items wide if I remember right. You can also bypass SSP if you find a separate memory disclosure vulnerability and learn the stack cookie. -fsta
802.
by strcat 12y ago
It works fine with PaX / grsecurity.
803.
by strcat 12y ago
That FAQ entry is out-of-date as it doesn't mention the write-ahead logging support. https://www.sqlite.org/wal.html
804.
by strcat 12y ago
Object inheritance is only useful in rare edge cases so your statement doesn't make much sense. Traits have default methods, inheritance and can be used as bounds on generics (no dynamic dispatch, type not lost) or as objects (dynamic
805.
by strcat 12y ago
You would have to force the sensitive content to be dynamically allocated. All types in Rust can be moved via a shallow memcpy and that will leave around dead shallow copies. For example, `Vec<T>` will leave around dead versions of th
806.
by strcat 12y ago
There are countless of WebKit-based browsers like Epiphany (GNOME Web), Midori, dwb and surf.
807.
by strcat 12y ago
> Besides FOSS, it really is a preference. Chrome is only closed source in the sense that Mozilla's Firefox builds are closed source. It doesn't have any features that are unavailable in Chromium. It ships with proprietary Pepp
808.
by strcat 12y ago
Chromium doesn't have any disadvantages in terms of privacy and security compared to Firefox and other open-source browsers. In fact, it has much more focus on security including a robust sandbox implementation and features like JIT ha
809.
by strcat 13y ago
Rust forces you to draw safety boundaries between safe and unsafe code, but you can do almost strictly more than C in unsafe Rust. It has support for inline assembly, SIMD, packed structs, and well-defined signed integer overflow. None of t
810.
by strcat 13y ago
DTrace and ZFS are both available for Linux as out-of-tree kernel modules. Sun intentionally used a GPL-incompatible license... it has nothing to do with NIH.

More ›